It was just that. And email with the new password. Hard to remember at first but then, somehow, I could type it from memory. Not sure how they got rid of the emails after they sent them but there are ways. It can be leaked from the source, true, but people with better technical skills were handling that source. So I guess overall it was better. The big insight might be that you can't evaluate the security of a system only from the technical aspect. You have to take into consideration also the human aspect. And that's a very weak point. Even Communism failed because they didn't take into consideration the human aspect (people don't want to work more if they get what everybody else gets anyway).

Automated regular password updates were often stopped because it leads to people writing them down, usually on a sticky note on the bezel of their monitor. Or, if it's just an update requirement then you get PasswordOct26, etc.